ROOT-APP-NPM-CVE-2026-47686 CVE-2026-47686 in vm2 - Patched by Root

Root has patched CVE-2026-47686 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-47698 CVE-2026-47698 in vm2 - Patched by Root

Root has patched CVE-2026-47698 in the vm2 package for Root:npm. Multiple fixed versions available...

CVE-2026-47686

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process...

CVE-2026-47683

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

CVE-2026-47698

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

CVE-2026-47683 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

CVE-2026-47683 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

CVE-2026-47683

In vm2

CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process...

CVE-2026-47686 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain a powerful host object such as process...

CVE-2026-47686

The GHSA advisory confirms vm2

CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

CVE-2026-47698

In vm2 versions ≤3.11.5, sandbox code exploits stacked indirection via Function.prototype.call to bypass prototype-chain protections in lib/bridge.js and lib/setup-sandbox.js, severing host intrinsic chains and reaching e.constructor.constructor for arbitrary host command execution. A published P...

CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

CVE-2026-47683

creationtimestamp| type| source ---|---|--- 2026-08-17 20:35:16+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9...

CVE-2026-47698

creationtimestamp| type| source ---|---|--- 2026-08-17 20:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtcjmnli3k24 2026-08-17 20:35:07+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-cfcw-xp6x-25gj 2026-08-17 22:08:18+00:0...

CVE-2026-47686

creationtimestamp| type| source ---|---|--- 2026-08-17 20:10:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtcj2snb5t2u 2026-08-17 20:35:14+00:00| published-proof-of-concept| https://github.com/patriksimek/vm2/security/advisories/GHSA-m283-3h24-438v 2026-08-17 22:08:09+00:0...

NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

Summary VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. Details The fix for https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg is insufficient an...

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

NPM: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...